Amazon Linux 2027 Preview Security Advisory: ALAS2027-2026-301
Advisory Released Date: 2026-11-02
Advisory Updated Date: 2026-11-02
Package updates are available for Amazon Linux 2027 that fix the following vulnerabilities:
CVE-2026-78667:
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) could consume an excessive amount of CPU.
These functions now ignore Range headers containing more than 200 ranges.
The limit is controlled by the new httpservecontentmaxranges=GODEBUG setting. Setting GODEBUG=httpservecontentmaxranges=0 disables the limit.
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81858
NOTE: Fixed by: https://github.com/golang/go/commit/ababc3cd873d8acce1777268aa7a817e6b672028 (go1.27.2)
NOTE: Fixed by: https://github.com/golang/go/commit/eb25b4e532c5a01f99ef860ec66743a8783f992b (go1.26.9)
Affected Packages:
git-lfs
Issue Correction:
Run dnf update git-lfs --releasever 2027.0.20261102 or dnf update --advisory ALAS2027-2026-301 --releasever 2027.0.20261102 to update your system.
aarch64:
git-lfs-debuginfo-3.7.1-2.amzn2027.aarch64
git-lfs-3.7.1-2.amzn2027.aarch64
git-lfs-debugsource-3.7.1-2.amzn2027.aarch64
src:
git-lfs-3.7.1-2.amzn2027.src
x86_64:
git-lfs-3.7.1-2.amzn2027.x86_64
git-lfs-debugsource-3.7.1-2.amzn2027.x86_64
git-lfs-debuginfo-3.7.1-2.amzn2027.x86_64